That's because it tends to break every program that wasn't built to run in a sandbox. There are (bad, ultimately) reasons why sandboxing is hard unless the ecos

That's because it tends to break every program that wasn't built to run in a sandbox. There are (bad, ultimately) reasons why sandboxing is hard unless the ecosystem and toolchains have been built from the ground up to run a program in a sandbox. For example, any dynamically linked program that needs to spawn a subprocess using a command that it doesn't ship alongside itself is going to cause problems in your sandbox. That turns out to be the vast majority of programs that have been shipped in the FHS universe for the last few decades. It's only recently that sandboxing has come into vogue. And the OS's that do a good job (like MacOS) get a bad rap from both developers and users who are mad their programs can't do what they want them to do because they don't have unfettered access to the filesystem any more.